Windows sign-in and Active Directory groups

DocView Capture can let people sign in with their Windows account instead of a separate password. When this is on, the sign-in page shows a Sign in with Windows button. Users are created automatically the first time they sign in, and you can map Active Directory groups to roles so that access follows group membership.

Password accounts keep working next to Windows sign-in. You can use both at the same time.

How it works

1. The user clicks Sign in with Windows on the sign-in page.
2. The web server checks the user's Windows identity (Negotiate: Kerberos or NTLM).
3. If DocView Capture has no user with that name yet, it creates one, for example CONTOSO\jsmith. The user is marked as a Windows account.
4. If you have mapped Windows groups to roles, DocView Capture updates the user's roles from their group membership.
5. IP access rules are checked, and the sign-in is recorded in the sign-in history with the method Windows.

A Windows sign-in lasts for the browser session. Closing the browser signs the user out.

Turn on Windows sign-in

Windows sign-in needs the web app to run on Windows with IIS Windows Authentication, or with Windows authentication configured for the web server.

On a new IIS installation

1. Prepare the server with the prerequisites script and its -WindowsAuthentication switch:

   .\deploy\iis\Install-Prerequisites.ps1 -WindowsAuthentication
   

2. Install the web app with the same switch:

   .\deploy\iis\Install-DocViewWeb.ps1 -Package .\DocViewCapture-Web-1.2.0.zip `
       -HostName capture.contoso.local -WindowsAuthentication ...
   

The script turns on IIS Windows Authentication next to anonymous access. It also writes the setting below to appsettings.Production.json. See Install on IIS for every parameter.

On an existing installation

1. Make sure IIS Windows Authentication is installed on the server.

2. In appsettings.Production.json, set:

   {
     "Authentication": {
       "Windows": { "Enabled": true }
     }
   }
   

3. Restart the site.

When the setting is false (the default), the Sign in with Windows button is not shown and the Windows sign-in address returns "not found". See the configuration reference.

Note: The install script refuses to continue if you ask for Windows sign-in but IIS Windows Authentication is not installed. Run Install-Prerequisites.ps1 -WindowsAuthentication first.

Map Windows groups to roles

1. Go to Administration › Users & roles.
2. Open the Windows groups tab.
3. In Group (DOMAIN\Group), type the group name, for example CONTOSO\Capture Operators.
4. Choose the Role the group's members should get.
5. Click Add.

Add one row per group and role. A group can map to several roles, and several groups can map to the same role. To remove a mapping, click the × at the end of its row.

The mapping is applied every time a user signs in with Windows:

• Roles that a mapping manages are added when the user is in the group, and removed when they are not.
• Roles that no mapping manages are left alone. So if you give a Windows user an extra role by hand, and no group maps to that role, it stays.

Tip: Write the group exactly as Windows shows it, in the form DOMAIN\Group. DocView Capture translates the user's group memberships into names in that form before it compares them.

Important: When you have no group mappings, a new Windows user is created without any role. They can sign in but cannot open any module. Either add group mappings, or give the new user roles on the Users tab after their first sign-in.

Group changes in Active Directory reach DocView Capture the next time the user signs in with Windows.

Managing Windows users

Windows users appear on the Users tab with "· Windows" under their name. You can:

• change their Display name;
• tick or untick Roles (remember that mapped roles are reset at the next sign-in);
• untick Active to stop them signing in, even though Windows still accepts their password.

Windows users have no New password box, because Windows checks their password.

A disabled Windows user who tries to sign in is sent to the access denied page. The attempt is recorded in the sign-in history with the reason "Account disabled".

Several servers and load balancers

When the web app runs on several servers behind a load balancer:

• enable sticky sessions on the load balancer;
• set "ReverseProxy": { "Enabled": true }, so that sign-in history and IP rules see the real client address.

See Install on IIS for details.

Troubleshooting

Related pages

• Users, roles and permissions
• Security
• Install on IIS
• Configuration reference